The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of package managers (npm, yarn) and runners (npx) to perform dependency audits, update manifest files, and execute code migration tools.
[EXTERNAL_DOWNLOADS]: Fetches documentation and changelogs from well-known repositories, such as the official React changelog on GitHub, to assist in identifying breaking changes.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates a potential attack surface for indirect prompt injection:
Ingestion points: The skill instructions involve reading external data such as changelogs via curl and processing local source code files in SKILL.md.
Boundary markers: There are no explicit delimiters or specific instructions to the agent to ignore potentially malicious embedded content in the files it processes.
Capability inventory: The skill allows the agent to execute shell commands (npm, yarn, npx) and write to files using the fs.writeFileSync method in the provided migration script in SKILL.md.
Sanitization: The migration logic uses regex-based string replacement for code transformations without sanitizing the input data or validating the integrity of the external changelog content.

dependency-upgrade